{
  "$schema_doc": "https://gtmstacker.com/registry/schema/entry.schema.json",
  "stability": "emerging",
  "generator": "agentic-media-registry",
  "generated_at": "2026-09-20T00:00:00Z",
  "id": "com.gtmstacker.registry/tool/security-audit-skill",
  "type": "tool",
  "slug": "security-audit-skill",
  "canonical_url": "https://gtmstacker.com/registry/tool/security-audit-skill/",
  "title": "Cloudflare security-audit-skill",
  "description": "MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Recon maps the app's trust boundaries, isolated hunter agents attack from separate angles (injection, access control, business logic, crypto), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is verified and machine-readable.",
  "category": "mcp-agents",
  "tags": [
    "mcp-agents",
    "agent-security",
    "code-review",
    "agent-skills",
    "self-hostable"
  ],
  "status": "active",
  "revision": 1,
  "content_hash": "886b250441e14cff52c4023e56f741cc8fc6c635eb1f8e8055880cf098341aad",
  "date_published": "2026-09-20T00:00:00Z",
  "date_modified": "2026-09-20T00:00:00Z",
  "source": {
    "name": "github · cloudflare/security-audit-skill",
    "url": "https://github.com/cloudflare/security-audit-skill"
  },
  "license": "MIT",
  "one_liner": "Cloudflare's security-audit-skill turns a coding agent into a multi-phase security auditor where the agent that checks a finding is never the one that found it.",
  "open_source": "yes",
  "self_hostable": "yes",
  "pricing_model": "free",
  "who_its_for": "A team that ships code an agent helped write and wants a structured, adversarial security pass on it, run inside the coding agent they already use, instead of trusting a single-shot LLM scan that buries them in unverified findings.",
  "aliases": [
    "security-audit-skill",
    "Cloudflare security audit skill"
  ],
  "alternatives": [
    "open-code-review",
    "bastionskill"
  ],
  "secondary_categories": [
    "ai-infrastructure",
    "productivity-knowledge"
  ],
  "last_verified": "2026-09-20",
  "evidence": {
    "claim_type": "mixed",
    "source_id": "https://github.com/cloudflare/security-audit-skill",
    "note": "MIT, ~17.8k stars, ~14 commits, published under the cloudflare GitHub org, and the six-phase adversarial design (recon / hunt / validate / structured output / independent verification / report, with the checker never the finder) confirmed on the repo (WebFetch + search 2026-09-20). It is the single-repo skill that seeded Cloudflare's internal vulnerability harness; the fleet-wide harness is theirs, this is the starting point."
  },
  "caveats": "It is a skill, not a standalone app: it needs a coding agent that supports tool use and parallel sub-agents (Claude-class), Node.js locally for validators, and an OS-enforced sandbox to run target code safely. Young by commits (~14). It structures and cross-checks the audit, but the findings still need a human to act on, and coverage depends on the agent driving it.",
  "lead": "MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Six phases run in order: recon maps the app's architecture and trust boundaries, isolated hunter agents attack from separate angles…",
  "chunks": [
    {
      "index": 0,
      "heading_path": [],
      "est_tokens": 159,
      "text": "MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Six phases run in order: recon maps the app's architecture and trust boundaries, isolated hunter agents attack from separate angles (injection, access control, business logic, crypto, feature abuse, chained attacks), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is machine-readable JSON with independent verification, and it installs through the Skills CLI."
    },
    {
      "index": 1,
      "heading_path": [
        null,
        "Provenance"
      ],
      "est_tokens": 207,
      "text": "agents attack from separate angles (injection, access control, business logic, crypto, feature abuse, chained attacks), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is machine-readable JSON with independent verification, and it installs through the Skills CLI.\n\n- MIT, ~17.8k stars, ~14 commits, the cloudflare org, and the six-phase adversarial design independently verified on the repo (WebFetch + search 2026-09-20). It is the skill that seeded Cloudflare's internal vulnerability-discovery harness.\n- Surfaced via the 2026-09-20 viral-posts brief (\"Cloudflare open-sourced their AI security audit skill for coding agents, six phases\").\n- Curated from the GTM Stacker signal registry (2026-09-20 pass); license independently verified 2026-09-20."
    },
    {
      "index": 2,
      "heading_path": [
        null,
        "Why it matters for a GTM stack"
      ],
      "est_tokens": 288,
      "text": "on the repo (WebFetch + search 2026-09-20). It is the skill that seeded Cloudflare's internal vulnerability-discovery harness. - Surfaced via the 2026-09-20 viral-posts brief (\"Cloudflare open-sourced their AI security audit skill for coding agents, six phases\"). - Curated from the GTM Stacker signal registry (2026-09-20 pass); license independently verified 2026-09-20.\n\nA lot of the GTM stack is now code an agent helped write, and the usual security pass is a single-shot LLM scan that either misses the real bug or drowns you in imagined ones. Cloudflare's skill takes the opposite stance: it assumes the agent is unreliable and designs around it, splitting recon, hunting and validation across separate agents and refusing to let the finder grade its own work. The output is verified, machine-readable findings instead of a wall of maybes. The honest read: this is a skill, not a product, so it rides on a capable coding agent, Node and a real sandbox, and it is early by commit count. But the adversarial, prove-it structure is the right shape for agent-run security work, and coming from Cloudflare it is worth wiring into your review step."
    }
  ],
  "alternates": {
    "markdown": "https://gtmstacker.com/registry/tool/security-audit-skill/index.md",
    "html": "https://gtmstacker.com/registry/tool/security-audit-skill/",
    "json": "https://gtmstacker.com/registry/tool/security-audit-skill/index.json",
    "server_json": "https://gtmstacker.com/registry/tool/security-audit-skill/server.json"
  },
  "jsonld": {
    "@context": "https://schema.org",
    "@graph": [
      {
        "@type": "WebSite",
        "@id": "https://gtmstacker.com/#website",
        "url": "https://gtmstacker.com/",
        "name": "GTM Stacker Agent Registry",
        "description": "A daily-updated, agent-native registry of open-source tool discoveries, tool updates, and curated news for the go-to-market / RevOps engineering niche. Machine-readable first: agents can discover, parse, page, and delta-sync it without scraping HTML.",
        "inLanguage": "en",
        "publisher": {
          "@id": "https://gtmstacker.com/#organization"
        }
      },
      {
        "@type": "Organization",
        "@id": "https://gtmstacker.com/#organization",
        "name": "GTM Stacker",
        "url": "https://gtmstacker.com",
        "description": "The growth-systems practice of Theo Popov: AI-native enrichment, outbound, content engines and internal tooling for startups and venture programs. Its agent-native media property, the GTM Stacker Agent Registry, maintains a daily-updated catalog of open-source go-to-market and RevOps tools that both people and AI engines can discover, compare, and cite.",
        "foundingDate": "2024-08",
        "knowsAbout": [
          "go-to-market engineering",
          "RevOps",
          "sales automation",
          "marketing operations",
          "open-source software",
          "AI agents"
        ],
        "founder": {
          "@type": "Person",
          "@id": "https://gtmstacker.com/#founder",
          "name": "Theo Popov",
          "jobTitle": "Growth Operations & GTM Systems",
          "url": "https://gtmstacker.com/about/",
          "sameAs": [
            "https://www.linkedin.com/in/theo-popov",
            "https://x.com/Theo_Popov",
            "https://github.com/theopopov"
          ],
          "worksFor": {
            "@id": "https://gtmstacker.com/#organization"
          }
        },
        "sameAs": [
          "https://www.linkedin.com/company/gtmstacker",
          "https://www.youtube.com/@gtmstacker",
          "https://www.instagram.com/gtmstacker/",
          "https://www.tiktok.com/@gtmstacker"
        ],
        "mainEntityOfPage": "https://gtmstacker.com/registry/about/"
      },
      {
        "@type": "SoftwareApplication",
        "@id": "https://gtmstacker.com/registry/tool/security-audit-skill/#software",
        "name": "Cloudflare security-audit-skill",
        "identifier": "io.github.cloudflare/security-audit-skill",
        "description": "MIT coding-agent skill from Cloudflare (JavaScript) that turns an agent into a multi-phase security auditor, built on the assumption the agent will hallucinate, so it makes the agent prove everything. Recon maps the app's trust boundaries, isolated hunter agents attack from separate angles (injection, access control, business logic, crypto), validation agents try to disprove each finding, and the agent that checks a finding is never the one that found it. Output is verified and machine-readable.",
        "applicationCategory": "DeveloperApplication",
        "url": "https://gtmstacker.com/registry/tool/security-audit-skill/",
        "datePublished": "2026-09-20T00:00:00Z",
        "dateModified": "2026-09-20T00:00:00Z",
        "isPartOf": {
          "@id": "https://gtmstacker.com/#website"
        },
        "license": "https://spdx.org/licenses/MIT.html",
        "codeRepository": "https://github.com/cloudflare/security-audit-skill",
        "keywords": "mcp-agents, ai-infrastructure, productivity-knowledge, agent-security, code-review, agent-skills, self-hostable",
        "author": {
          "@type": "Organization",
          "name": "cloudflare",
          "url": "https://github.com/cloudflare",
          "sameAs": [
            "https://github.com/cloudflare/security-audit-skill"
          ]
        },
        "offers": {
          "@type": "Offer",
          "price": 0,
          "priceCurrency": "USD"
        },
        "isSimilarTo": [
          {
            "@type": "SoftwareApplication",
            "name": "Open Code Review",
            "url": "https://gtmstacker.com/registry/tool/open-code-review/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          },
          {
            "@type": "SoftwareApplication",
            "name": "Bastionskill",
            "url": "https://gtmstacker.com/registry/tool/bastionskill/",
            "applicationCategory": "DeveloperApplication",
            "offers": {
              "@type": "Offer",
              "price": 0,
              "priceCurrency": "USD"
            }
          }
        ]
      },
      {
        "@type": "BreadcrumbList",
        "@id": "https://gtmstacker.com/registry/tool/security-audit-skill/#breadcrumb",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "GTM Stacker Registry",
            "item": "https://gtmstacker.com/registry/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "MCP Agents",
            "item": "https://gtmstacker.com/registry/category/mcp-agents/"
          },
          {
            "@type": "ListItem",
            "position": 3,
            "name": "Cloudflare security-audit-skill",
            "item": "https://gtmstacker.com/registry/tool/security-audit-skill/"
          }
        ]
      }
    ]
  },
  "tool": {
    "name": "io.github.cloudflare/security-audit-skill",
    "repository": {
      "url": "https://github.com/cloudflare/security-audit-skill",
      "source": "github"
    }
  }
}